Privacy Policy

This Privacy Policy explains how Tradeventure (“we”, “us”) collects, processes, and protects your personal data when you use the service at tradeventure.app. We are committed to the principles of the EU General Data Protection Regulation (GDPR).

1. Data controller

The data controller responsible for your personal data is:

Jakub Dyk, sole proprietor
Prague, Czech Republic
Contact: support@tradeventure.app

2. What data we collect

Account data

Email address, username, preferred language, timezone, and currency settings.

Trading data

Trades you enter or import (symbol, direction, entry/exit prices, quantity, P&L, timestamps, notes), journal entries (morning mood, evening reflections), trading rules, and folder/strategy configuration.

AI Coach data

Conversation history with the AI Coach, stored so you can review past discussions.

Companion data

Your discipline score history, the folder you bound the Companion to, and the Companion's state (phase, rest, reset mode).

Prop firm data

Firm configuration (firm name, phase, account size), drawdown rules, daily loss limits, and phase progress.

Technical data

IP address (kept in server logs for 30 days), browser user agent string (server logs). Used for security, fraud prevention, and basic error diagnostics.

Payment data

Payment processing is handled by Stripe, Inc. acting as Merchant of Record. Stripe collects and processes your payment information (name, billing address, payment method details, transaction history) directly. We store only your Stripe customer ID, subscription status, plan tier, and billing interval. We never see or store your full payment card details. VAT and sales tax are collected by Stripe where applicable based on your location.

Waitlist data

When you join the waitlist at tradeventure.app/waitlist, we collect:

• Your email address (required, primary identifier).
• A SHA-256 hash of your IP address for abuse prevention. We never store the raw IP, and the hash is not reversible.
• Your user agent string, truncated to 500 characters.

Lawful basis: explicit consent under GDPR Article 6(1)(a) — you actively tick the consent checkbox before submitting. Pre-checked boxes are not valid consent and we do not use them.

Purpose: to email you when Tradeventure launches on AppSumo, plus a small number of launch-related updates. We do not share this data with third parties and we do not sell it. Ever.

Retention: until you unsubscribe, or 24 months after the AppSumo launch, whichever comes first. Unsubscribe via the one-click link in every email.

Processor: Resend (privacy policy). Email delivery only — Resend does not reuse the data for its own purposes.

3. What we do NOT collect

• Trading-account login credentials (username + password) — we never ask for them. Statement imports are file uploads; the Binance integration (Pro and Founder tiers) uses a read-only API key plus secretthat you generate yourself in Binance's API Management page. Read-only API keys cannot place trades, withdraw, or modify your account. We store the key & secret encrypted at rest using AES-256-GCM with a random IV per record; plain values never touch disk and are never logged. You can revoke access at any time by deleting the key in Binance.
• Full payment card details — handled entirely by Stripe; we only retain a Stripe customer ID reference
• Location data beyond what your IP address reveals (approximate country only)
• Social media profiles, contacts, or third-party account data
• Tracking cookies or analytics data — we do not use Google Analytics, Facebook Pixel, or any similar service

4. Legal basis for processing (GDPR Article 6)

• Contract performance (Art. 6(1)(b)) — processing your account data, trading data, and journal entries is necessary to provide the service you signed up for
• Legitimate interest (Art. 6(1)(f)) — server logs and technical data are processed to keep the service secure, stable, and free of abuse
• Consent (Art. 6(1)(a)) — when you choose to use the AI Coach, you consent to your trading context being sent to Anthropic for response generation. You can use Tradeventure fully without the AI Coach.

5. How we use your data

• Provide and maintain the service you signed up for
• Compute trading statistics, streaks, equity curves, and analytics
• Power AI Coach responses (when you use that feature)
• Run the Companion discipline algorithm locally (no AI — pure math)
• Send service-related emails only: account confirmation, password reset, notices of material changes to these policies

We do not send marketing emails without your explicit opt-in consent. We do not use your data to train AI models, ours or anyone else's.

6. AI data usage

The data sent includes your aggregated trading statistics, recent trades, and relevant journal context needed for the coaching conversation. Per Anthropic's commercial terms, API inputs are not used to train Anthropic models.

You can use Tradeventure entirely without the AI Coach — in that case, no trading data is transferred to Anthropic. AI Coach conversation history is stored in our database and you can delete it at any time.

7. Sub-processors (data sharing)

We share your data only with the following sub-processors, strictly as needed to provide the service:

We do not sell, rent, or trade your personal data to any third party, ever.

8. International data transfers

Your data is primarily stored in Supabase's EU (Frankfurt) region. However, when you use the AI Coach, data is transferred to Anthropic in the United States. Payment processing transfers data to Stripe, Inc. in the United States. Vercel may serve requests from US or EU edge locations depending on your geographic location.

Transfers to the United States are covered by the Standard Contractual Clauses (SCCs) as implemented by each sub-processor (Stripe, Anthropic, Vercel, Resend). By using the AI Coach or payment features, you acknowledge these transfers.

9. Cookies

We use essential cookies only— specifically, the Supabase session token required to keep you logged in. We do not use tracking cookies, advertising cookies, or analytics cookies. Because we rely solely on essential cookies, a cookie consent banner is not required under GDPR & ePrivacy rules.

10. Your rights (GDPR Chapter III)

You have the following rights regarding your personal data:

• Access (Art. 15) — request a copy of all personal data we hold about you
• Rectification (Art. 16) — correct inaccurate data via Profile / Settings, or by contacting us
• Erasure (Art. 17)— request deletion of your account and all data (“right to be forgotten”)
• Data portability (Art. 20) — request your data in a structured, machine-readable format
• Restriction (Art. 18) — request that we limit how we process your data
• Objection (Art. 21) — object to processing that is based on legitimate interest
• Withdraw consent (Art. 7(3)) — withdraw AI Coach consent at any time simply by not using the feature

To exercise any of these rights, email support@tradeventure.app. We will respond within 30 days.

11. Data retention

• Active accounts — data is retained for as long as your account is active
• Deleted accounts — all user data permanently deleted within 30 days of your deletion request
• Server logs (IP address, browser user agent) — retained for 30 days, then auto-deleted
• AI Coach conversations — retained until you delete them or delete your account

12. Data breach notification

In the event of a personal data breach that is likely to affect your rights and freedoms, we will notify you by email and inform the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Articles 33 and 34.

13. Data security

• Row-Level Security (RLS)in the database ensures that no user can access another user's data
• All connections are encrypted via HTTPS / TLS
• Authentication tokens expire and are refreshed securely
• Passwords are never stored in plain text — Supabase Auth handles them with bcrypt hashing

14. Children

Tradeventure is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us and we will delete the account and associated data.

15. Supervisory authority

You have the right to lodge a complaint with your local data protection authority. In the Czech Republic, the supervisory authority is Úřad pro ochranu osobních údajů (ÚOOÚ) — www.uoou.cz.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified to registered users by email at least 30 days before taking effect. The updated policy will be posted at tradeventure.app/privacywith a new “Last updated” date.

17. Contact

Questions about this Privacy Policy or how we handle your data? Contact support@tradeventure.app. See also our Terms of Service and FAQ.